Move the prepare out of the while loop. No need to prepare the same statement more than once.
Use placeholders to get rid of SQL injection problems, and to improve performace by allowing to cache the prepared statement inside the database engine.
prepare the insert statement outside the while loop, and use placeholders, for the same reasons.